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CLAIMS: 

1. A method of secret key agreement between a first (16) and a second (18) 
correspondent, the method comprising the acts of: 

5 (a) said first correspondent receiving a response A, jfrom a source P (20); 

(b) said second correspondent receiving a response B from said source P 

(20); 

(c) said first correspondent generating (d-1) parity symbols as an output of 
a codeword W whose input includes said response A and a secret key K selected by said 

1 0 first correspondent (16); 

(d) said first correspondent (16) transmitting said (d-1) parity symbols 
over a public communication channel (22) to said second correspondent (18); and 

(e) said second correspondent (18) generating a word W whose input 
includes said (d-1) parity symbols and said response B to determine said secret key K. 

15 

2. The method of Claim 1, wherein said responses A and B are received by 
said respective first (16) and second (18) correspondents responsive to a challenge C 
generated from said respective first (16) and second (18) correspondents. 

20 3. The method of Claim 1, wherein said response A is comprised of a 
sequence of symbols of the form A=(ai, an)- 

4. The method of Claim 1, wherein said response B is comprised of a 
sequence of symbols of the form B=(b 1 , ,bn). 

25 

5. The method of Claim 1, wherein said secret key K is comprised of a 
sequence of symbols of the form K=(ki, jk^). 

6. The method of Claim 1, wherein the secret key K may be determined from 
30 said (d-1) parity symbols and said response B by satisfying an inequality, 

dH(A,B)< = (d-l-k)/2 
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where dH(A,B) is the Hamming distance between symbol sequences A and B, 
d is the minimum distance, and 
k is the number of symbols in the secret key K. 

7. The method of Claim 1, wherein the codeword W is a Reed-Solomon 
codeword. 



8. The method of Claim 1, wherein the secret key K cannot be determined by 
10 someone other than said first and second correspondent (18) if the following inequality is 
satisfied, 

dH(A,E)>=d.l 

where: E is a symbol sequence obtained by an attacker (17) attempting to learn 

15 the secret key K, 

dH(A,E) is the Hamming distance between the symbol sequences A and E, 



and 



d is the minimum distance. 



20 9. A method of secret key agreement between a first and a second 

correspondent (18), the method comprising the acts of: 
during an enrollment phase: 

(a) sending to a source (20), a challenge C, jfrom a first 
correspondent (16) at a time tl; 

25 (b) said first correspondent (16) receiving said response A to said 

challenge C; 

(c) sending to said source (20), said challenge, fi-om said second 
correspondent (18) B at a time t2; 

(d) said second correspondent (18) receiving a response B to said 

30 challenge C. 

during an encoding phase, said first correspondent (16): 
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(a) selecting a secret key K; 

(b) forming a codeword W using said secret key K and said 
response A to generate (d-1) parity symbols P; 

(c) transmitting said (d-1) parity symbols P to said second 
S correspondent (18) over a public communication channel; 

during a decoding phase, said second correspondent (18): 

(a) using said d-1 transmitted parity symbols and said response B 
to construct a word W to determine the secret key K. 

10 10. The method of Claim 9, wherein said response A is comprised of a 
sequence of symbols of the form A=(ai, an). 

11. The method of Claim 9, wherein said response B is comprised of a 
sequence of symbols of the form B=(bi, ,bn). 

15 

12. The method of Claim 9, wherein said secret key K is comprised of a 
sequence of symbols of the form K=(ki , ,kjc)- 

13. The method of Claim 9, wherein the secret key K may be determined from 
20 said word W if and only if the inequality is satisfied 

dH(A,B)< = (d-l-k)/2 

where dH(A,B) is the Hamming distance between symbol sequences A and B, 
d is the minimum distance, and 
25 k is the number of symbols in the secret key K. 

14. The method of Claim 9, wherein the codeword W is a Reed-Solomon 
codeword. 
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15. The method of Claim 9, wherein the secret key K cannot be determined 
from someone other than said first and second correspondent (18) if and only if the 
following inequality is satisfied: 

dH(A,E) >= d-1 

where E is a symbol sequence obtained by an attacker (17) attempting to learn 

the secret key K, 

dH(A,E) is the Hamming distance between the symbol sequences A and E, 

and 

d is the minimum distance. 

16. A method of secret key agreement between a first and a second 
correspondent (18), the method comprising the acts of: 

said first correspondent (16) receiving a response A from a source P (20); 
said second correspondent (18) receiving a response B from said source P 

(20); 

said first correspondent (16) generating (d-1) parity symbols as an output 
of a codeword W whose input includes said response A and a secret key K selected by 
said first correspondent (16); 

said first correspondent (16) transmitting said (d-1) parity symbols and a 
pseudo-random fimction evaluated in A, over a public communication channel to said 
second correspondent (18); and 

said second correspondent (18) generating a word W whose input 
includes said (d-1) parity symbols, said pseudo-random function evaluated A, and said 
response B, to determine said secret key K selected by said first correspondent (16). 

17. The method of Claim 16, wherein the pseudo-random function is a hash 
function of the form h(A)=(h(al ),..., h(an)), where A is the response A from said source P 
(20). 
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18. The method of Claim 16, wherem said response A is comprised of a 
sequence of symbols of the form A=(ai, an). 

19. The method of Claim 16, wherein said response B is comprised of a 
5 sequence of symbols of the form B=(bi , ,bn). 

20. The method of Claim 16, wherein said secret key K is comprised of a 
sequence of symbols of the form K=(ki, ,kk). 



10 21. The method of Claim 1 6, wherein the secret key K may be determined 

from said word W if the inequality is satisfied, 

dH(A,B)< = (d-l-.k) 



15 



where dH(A,B) is the Hamming distance between symbol sequences A and B, 
d is the minimum distance, and 
k is the number of symbols in the secret key K. 



20 



25 



30 



22. The method of Claim 16, wherein the codeword W is a Reed-Solomon 
codeword. 



23. The method of Claim 16, wherein the secret key K cannot be determined 
from someone other than said first and second correspondent (18)s if the following 
inequality is satisfied: 

dH(A,E) >= d-1 



where 



and 



E is an attacker (17) attempting to learn the secret key K, 

dH(A,E) is the Hanmiing distance between the symbol sequences A and E, 

d is the minimum distance. 
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24- A method of secret key agreement between a first and a second 
correspondent (18), the method comprising the acts of: 
during an enrolknent phase: 

sending to a source (20), a challenge C, from said first 
5 correspondent ( 1 6) at a time 1 1 ; 

receiving said response A to said challenge C; 
sending to said source (20), said challenge C, from said second 
correspondent (18) at a time t2; 

during an encoding phase: 
10 said first correspondent (16) selecting a secret key K; 

forming a codeword W using said secret key K, a response A 
received by said first correspondent (16) during an enrollment phase and d-1 parity 
symbols P; 

transmitting said d-1 parity symbols P and h(A) a pseudo -random 
15 function of A from said first correspondent (16) to said second correspondent (18) over a 
public communication channel; 

during a decoding phase: 

using said d-1 transmitted parity symbols and said pseudo-random 
function evaluated in A by said second correspondent (18) to construct a word W to 
20 determine the secret key K. 

25. The method of Claim 24, wherein the pseudo-random function is a hash 
function h(A)=(h(a_l),...,h(a_n)) 

25 26. The method of Claim 24, wherein said response A is comprised of a 
sequence of symbols of the form A=(ai, an). 

27. The method of Claim 24, wherein said response B is comprised of a 
sequence of symbols of the form B=(bi, ,bn). 

30 
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28. The method of Claim 24, wherein said secret key K is comprised of a 
sequence of symbols of the form K^O^i, ,kk). 

29. The method of Claim 24, wherein the secret key K may be determined 
5 from said word W if the inequality is satisfied, 

dH(A,B)< = (d--l-k) 

where dH(A,B) is the Hamming distance between symbol sequences A and B, 
d is the minimum distance, and 
10 k is the number of symbols in the secret key K. 

30. The method of Claim 24, wherein the codeword W is a Reed-Solomon 
codeword. 



15 31. The method of Claim 24, wherein the secret key K cannot be determined 

from someone other than said first and second correspondents (16,18) if the following 
inequality is satisfied: 

dH(A,E)>=d-l 

20 where E is a symbol sequence obtained by an attacker (17) attempting to learn 

the secret key K, 

dH(A,E) is the Hamming distance between the symbol sequences A and E, 



25 



and 



d is the minimum distance. 



32. A method of secret key agreement between a first and a second 
correspondent (18), the method comprising the acts of: 

said first correspondent (16) receiving a response A from a source P (20), 
where A is a set of symbols; 
30 said second correspondent (18) receiving a response B from said source P 

(20), where B is a set of symbols; 
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said first correspondent (16) ordering the set of symbols A into a 
sequence, aj, ,aN; 

said first correspondent (16) computing a pseudo-random function of the 
ordered set of symbols A, h(A); 
5 said first correspondent (16) transmitting h(A)=(h(al),. . .h(an)) to said 

second correspondent (18); and; 

said second correspondent (18) computing a pseudo-random function of 
the ordered set of symbols B, h(b) for each symbol b in the set B; 

said second correspondent (18) computing a set S which includes all 
10 positions j for which there exists an element in B such that h(aj) = h(b); 

said second correspondent (18) transmitting the set S back to said first 
correspondent (16); and 

both first and second correspondents (16, 18) extracting a joint key J based 
on the symbols aj, j in S and for those symbols b in set B for which h(af) = h(b). 

15 

33. The method of Claim 32, further comprising the act of extracting a secret 

* 

key K from said joint key J using privacy amplification. 

34. The method of Claim 33, wherein using said privacy amplification 

20 includes using one of a random matrix multiplier for multiplication with the joint key J 
and the joint key J evaluated in a hash function. 

35. The method of Claim 32, wherein said responses A and B are received by 
said respective first (16) and second (18) correspondents responsive to a challenge C 

25 generated from said respective first (16) and second (18) correspondents. 

36. The method of Claim 32, wherein said response A is comprised of a 
sequence of symbols of the form A=(ai, an)- 

30 37. The method of Claim 32, wherein said response B is comprised of a 
sequence of symbols of the form B=(bi, ,bn). 
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38. The method of Claim 32, wherein said secret key K is comprised of a 
sequence of symbols of the form K=(kb Mid- 
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